Legal
Privacy Policy
Version 1.0 · Updated 2026-10
This is a v1.0 draft. It will be finalized under review by licensed counsel before commercial launch; the finalized version will govern.
1. Information we collect
- Account information: registration email, phone number (if you sign in with SMS codes), company name and role.
- Company profile and business data: information you enter in the workspace — company details, target markets, diagnosis questionnaires, evidence items, ESG metrics — used solely to provide the service to your organization.
- Usage data: sign-in logs, feature usage records and security audit events, used for account security and product improvement.
- AI conversation content: your conversations with the AI Compliance Advisor are saved to your session history so you can review and continue them.
2. How we use information
- To provide, maintain and improve platform features (compliance assessments, reports, evidence register, AI advisory).
- To generate compliance analysis based on your company profile and our knowledge base; AI outputs carry source citations where sources are retrieved, for your verification.
- To send necessary service notices (security alerts, major feature changes).
- We do not sell your business data to third parties, nor use it for unrelated profiling or advertising.
3. Storage and security
- Data is hosted on Supabase (Postgres) with encryption in transit and at rest.
- The application is hosted on Vercel, whose platform carries the request data the application processes and its runtime logs.
- Multi-tenant data is isolated per organization via row-level security (RLS); service-role keys are used only in controlled server environments.
- AI inference is processed by our model provider (DeepSeek) with only the conversation and profile context needed for the request; we do not share unrelated data.
- Embeddings for retrieval are generated by SiliconFlow: the retrieval text of your questions and the platform knowledge-base corpus are sent to that service to produce retrieval vectors.
- Writes proposed by the Multi-Tool Agent Advisor (such as business records) require human approval and leave audit events.
- The full list of these providers and their status is in Annex III of the Data Processing Agreement.
4. Your rights
- Access and correction: you can view and update your company profile and business data in the workspace.
- Export and deletion: contact us to export your organization data, or to close the account and delete associated data (except audit records we must retain by law).
- If you are in a jurisdiction covered by GDPR/PIPL or similar laws, you also hold the corresponding data-subject rights; we respond within statutory timelines.
6. Contact us
- For privacy questions and data-subject requests (access, correction, export, deletion and so on), submit them via the contact page and mark them “privacy request”; workspace customers can also open a support ticket from their workspace.